What does cyber insurance require from our IT?

Cyber-insurance applications have gotten strict. Where they once asked a few checkbox questions, insurers now require detailed attestations: Is MFA enforced on email and remote access? Do you run endpoint detection and response? Are backups encrypted, off-site, and tested? How quickly are critical patches applied? Your premium, and whether you can get coverage at all, depends on the answers.

The dangerous part is answering aspirationally. If a claim investigation finds the controls you attested to weren't actually in place, the insurer can deny the claim, after the incident, when you need it most. This has happened enough to be a pattern, not a rumor.

The practical move: have your IT provider sit with you when completing the questionnaire, answer only what's verifiably true, and treat any 'no' answers as a to-do list. A good MSP already runs the controls insurers ask about, because the insurers' list is essentially the same security-fundamentals list from the cybersecurity question above.